ALBERTA HOTEL & LODGING ASSOCIATION ARE YOU COVERED? Presented - PowerPoint PPT Presentation

1 ALBERTA HOTEL & LODGING ASSOCIATION ARE YOU COVERED? Presented by: Patricia McLeod, Q.C., ICD.D Corporate Director; Legal, Compliance and Governance Advisor

Why do we care about the security of information? In Canada, data protection and cybersecurity are governed by complex legal and regulatory frameworks. Failure to understand and take active steps to reduce these risks (or the impacts of a breach) can have serious legal, financial and personal liability consequences for organizations and leaders

AGENDA 3 There are numerous statutes that require organizations to protect the personal information that is within their control. In addition, there is an evolving body of case law developing in response to privacy and data protection breaches. We will discuss: • Privacy • Cybersecurity (OSFI and Canadian Securities regulations) • Payment Card Industry (PCI) Compliance

4 LEGAL DISCLAIMER This presentation is to provide you with an oversight of key compliance risks and (1) is not provided in the course of and does not create or constitute an attorney-client relationship, (2) is not intended as a solicitation, (3) is not intended to convey or constitute legal advice, and (4) is not a substitute for obtaining legal advice from a qualified attorney. You should not act upon any such information without first seeking qualified professional counsel on your specific company and risks. If these materials are copied or disseminated, this disclaimer will apply to all individuals who obtain and/or use this information.

5 Privacy in Canada “Privacy is not simply a precious and often irreplaceable human resource ; respect for privacy is the acknowledgement of respect for human dignity and of the individuality of man.”

6 What is the Purpose of Privacy Legislation? • Privacy legislation protects an individual’s personal information from being collected, used or disclosed without that individual’s informed consent. • Privacy legislation applies ONLY to information that is collected, used or stored for COMMERCIAL PURPOSES . • At both federal and provincial levels, investigations can result in: • Public notices (reputational risk!) • Fines of up to $100,000 • At the provincial level, an adverse finding can be used as a cause of action by individuals and damages can be sought! • Understanding your obligations and establishing an effective privacy policy and strong procedures around privacy can set up your organization to manage personal information effectively and significantly avoid risks!

7 A Little History • PIPEDA (effective January 1, 2001) is the federal legislation but the Federal Government can only regulate commercial matters within their jurisdiction Federal works and undertakings • Interprovincial and international commerce • • Provincial governments had until January 1, 2004 to enact “substantially similar legislation” • Failure to do so would result in PIPEDA “dropping down” to apply to provinces

8 Personal Information Protection Act (provincial acts) • Provincial legislation must be substantially similar to PIPEDA • The provinces are substantially similar to each other • Initial drafts of legislation were developed together • Privacy Commissioners of British Columbia, Alberta and Canada coordinate monitoring and recommendations/advice to public and private sector • Alberta has mandatory reporting of privacy breaches in certain circumstances • Provincial legislation essentially applies to the collection, use and disclosure of personal information in the private sector within provincial boundaries

9 Canada versus the World The map shows the number of privacy rules by country – Canada is amongst the highest in the world!

10 What is Personal Information?

11 What is Personal Information? Personal Information means information about an identifiable individual What is not personal information? • Business contact information • Work product information • Information that cannot identify an individual or be ascribed to an individual The definition is very broad. Does not need to be written information, can be blood samples, phone calls, DNA, fingerprints, medical records, voice recordings, photographs “Personal element” - ties into the overarching purpose of the legislation, which is to protect individual’s privacy “Sensitive personal information” some information is more sensitive, for example medical or financial information. This information requires a greater level of protection and care. • However, other information (like the books you read, your height, etc.) may not be particularly sensitive, but is still personal information and should still be protected. It is important that you know how to identify personal information so that you can properly protect it.

12 What is Exempt? • PIPA and PIPEDA do not apply to information shared for purely personal purposes (ie, a co-worker emails you to ask about going out for lunch) and business contact information, or information collected for journalistic, literary or artistic purposes • Government organizations are not covered by the privacy legislation as there is government specific (FOIP, FIPPA) legislation regarding the protection and disclosure of information • “business contact information” means • Information found on your business card: name, business email and phone number and position title • PIPEDA does not include an individual’s work email address as business information • PIPA- BC also includes an exemption for “work product information”

13 Work Product Exemption • Information generated in the course of an employee’s work is not the employee’s personal information • BUT it can still be the personal information of a client • This means that the work product must be protected and/or disclosed to individuals making access requests about their own information

14 10 Principles of Information Practices 1. Accountability belongs to all of us; 2. Identify the purposes for which you are collecting the personal information; 3. Always obtain consent ; 4. Limit collection to only that information which you reasonably require; 5. Limit use, disclosure, retention – use or disclose personal information only for the purpose which it was collected, and only keep it as long as necessary to satisfy these purposes;

15 Continued… 6. Ensure accuracy when recording or disclosing personal information; 7. Safeguard personal information from unauthorized access, disclosure, copying or use; 8. Practice openness about our management of personal information by directing clients and employees to Western’s Privacy Statement; 9. Provide individuals with access to their information , and correct or amend it if necessary to ensure accuracy and completeness; 10. Provide recourse by developing simple and accessible complaint procedures, and taking appropriate measures to correct information handling practices and policies where necessary.

16 Consent • Consent is the cornerstone of handling personal information. Must obtain consent to collect or disclose personal information. • Consent is only valid if the person consenting understands the nature, purpose and consequences of the collection, use and disclosure of their information. • Cannot use the information provided for purposes other than those which the client could have reasonably understood at the time of consent • That means CANNOT use client information to cross-sell products, implement targeted advertising, etc. unless the individual understood that as part of their consent • This is a common danger of “standard form consents” that are too broad or do not clearly specify what a customer could reasonably expect their information to be used for

17 Obtaining Consent • Before personal information is collected, identify why it is needed and how it will be used • Inform the individual of: The purposes for which you are collecting their information • What the information will be used for • To whom it will be disclosed • • Prior to using it for any other purpose, obtain an updated consent

18 What you share! General Rule : Do not share personal information with anyone other than the individual whose information it is Be extremely careful about what you share and with whom. Under no circumstances should any employee share personal information about an individual with anyone who does not reasonably require this information in order to provide the requested product or service to the client

19 Best Practices in Handling Personal Information Keep workspaces organized, with client/employee files secured in a locked cabinet or • drawer when not in use Do not keep passwords in plain view and change regularly • Double check email addresses or facsimile numbers AND open up attachments before • hitting SEND Securely shred waste paper containing personal information • Take steps to ensure that any personal information of customers that is in your • possession is securely locked before leaving it unattended Use caution when accessing or viewing personal information in a public location • Conduct client meetings in private offices or over the phone in secure locations or work • locations Immediately report the loss or theft of any personal information to your corporate • privacy officer (ie, missing files, theft or loss of a company laptop or cellular device)